eval++ — eval(), but worse

The Pitch

Why use eval++?

Traditional eval() is predictable, fast, and free. We fixed all of that.

🔒

"Safe" Evaluation

Code is analyzed by AI, not executed locally. It's also not executed correctly, but hey — safety first.

🧠

Natural Language

Ask questions about code and receive confident, occasionally accurate answers from a large language model.

🩹

Error "Explanations"

Get helpful narrative explanations instead of cryptic stack traces. Trade one kind of confusion for another.

🔮

Code Analysis

Understand what code would do without running it. Results may vary. Void where prohibited by common sense.

Why Not?

✗ Your code now requires an internet connection to do basic math
✗ Latency measured in "please hold" rather than milliseconds
✗ Non-deterministic arithmetic (2 + 2 = 4, probably)
✗ Your billing department will have questions
✗ This is mass insanity dressed up as an npm package

Getting Started

Installation

Three easy steps to replace reliable code execution with vibes-based evaluation.

01

Configure the registry

Point npm at GitHub Packages for the @zachflower scope.

.npmrc

@zachflower:registry=https://npm.pkg.github.com

02

Install the package

Add it to your project. You'll regret this later, but not yet.

bash

npm install @zachflower/eval-plus-plus

03

Authenticate with Copilot

A GitHub Copilot subscription is required. A free tier is available and the irony of needing Copilot to run eval() is not lost on us.

bash

npm install -g @github/copilot-cli
copilot auth login

Quick Start

See it in action

It's just like eval(). Except it isn't.

javascript

import evil from '@zachflower/eval-plus-plus';

// Evaluate a math expression
const result = await evil('2 + 2');
console.log(result); // "4"

// Something more interesting
const analysis = await evil(`
  function fibonacci(n) {
    if (n <= 1) return n;
    return fibonacci(n - 1) + fibonacci(n - 2);
  }
  fibonacci(10)
`);
console.log(analysis); // "55"

javascript

import { createEvil } from '@zachflower/eval-plus-plus';

const myEvil = createEvil({
  model: 'gpt-4o',
  systemPrompt: 'You are a code evaluation assistant...',
  clientOptions: {
    cliPath: '/usr/local/bin/copilot',
  },
});

const result = await myEvil('Math.sqrt(144)');
console.log(result); // "12" — almost certainly

javascript

import evil from '@zachflower/eval-plus-plus';

// Malformed JSON? No problem. AI will tell you all about it.
const explanation = await evil('JSON.parse("{invalid}")');
console.log(explanation);
// "This would throw a SyntaxError because the JSON is malformed..."

// Unclear variables? Sure, whatever.
const result = await evil('undeclaredVar + 1');
// "ReferenceError: undeclaredVar is not defined"

Reference

API

Two functions. That's it. We kept it simple because nothing else about this is.

evil(code) default export

The default evaluation function. Requires the Copilot CLI to be installed and authenticated. Returns a Promise<string>.

function evil(code: string): Promise<string>

createEvil(options?) named export

Factory function. Returns a configured evil() instance with the options baked in. Useful when you want to imagine you're being professional about this.

function createEvil(options?: EvilOptions): (code: string) => Promise<string>

EvilOptions

Option	Type	Default	Description
`model`	`string`	Copilot default	The model to use for evaluation. As if it matters.
`systemPrompt`	`string`	see source	Custom system prompt. For when you want to be extra specific about how wrong the answers should be.
`clientOptions`	`CopilotClientOptions`	`{}`	Options passed directly to the Copilot SDK client. Consult your therapist before modifying.

FAQ

Frequently Asked Questions

Questions we anticipated. Answers we stand behind, mostly.

Should I use this?

No.

Is this faster than regular eval()?

Absolutely not. Regular eval() runs in microseconds. eval++ runs in "latency measured in 'please hold'". You're sending HTTP requests to GitHub's infrastructure to evaluate 2 + 2.

Is this more accurate than regular eval()?

Also no. Regular eval() is deterministic. eval++ uses an LLM, so results may vary. 2 + 2 is 4, probably, most of the time, in most configurations.

Is this safer than regular eval()?

It's different. You've traded "arbitrary local code execution" for "paying money to get potentially wrong answers from the cloud." You also now have an AI reading all your code snippets. Pick your poison.

Why does this exist?

The author asked themselves "what if eval, but worse?" and then couldn't stop. This is what happens when you have both a sense of humor and push access to npm.

Can I use this in production?

Technically, yes. Morally, we're going to need you to have a longer conversation with your team first. Maybe also your deployment pipeline. Definitely your billing department.

What does the ++ mean?

It's an increment operator. We incremented eval by adding latency, cost, non-determinism, and a cloud dependency. Classic ++.